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17 July 1972 


MEMORANDUM FOR: Assistant Deputy Director of Security (PTOS) 


SUBJECT : Agency Annual Report 


Forwarded herewith as an attachment is this Division's 
contribution to the Agency Annual Report. For ease of identi- 


fication, the items have been grouped by Branch or Staff. 
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Deputy Chief, Physical Security Division 
Att 
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AGENCY ANNUAL REPORT 
PHYSICAL SECURITY DIVISION 


MAJOR DEVELOPMENTS 
aE eV EEN 


ed 


Th i lopment which occurred within the 
during FY-72 was the application of 

its expanded resources to the problem of conducting a security 
analysis, test and evaluation of a remotely accessed resource- 
sharing computer system. The first system selected for an accredi- 
tation test, required by DCID 1/16, is the OCS IBM 360/67-1 Time- 
Sharing System. This test, now in its initial stage, is an in-depth 
examination of the procedural, personnel, physical, technical and 
hardware -software protective features which comprise the total 
security environment of the computer system to be examined. An 
important aspect of this test is the utilization of a commercial con- 
tractor who will conduct penetration-type testing of the IBM 360/67-1 


Operating System. Following the com is comprehensive 
a significant first step in meeting the challenge contained in DCID 


1/16. 


Po 


The Interagency Advisory Committee on Security Equipment 
established a subcommittee chaired by a member of this Branch to 
evaluate the vulnerability of U. S. Government safekeeping equip- 
ment and to select a course of action for correcting and/or limiting 
this problem. This effort has succeeded in convincing both govern- 
ment and private industry of the threat to the overall security of 
classified documents and has caused, for the first time, a consensus 
of both to make a concerted effort to correct the problem. Industry 
has already offered solutions to lessen or correct vulnerabilities 
while interagency government efforts are proceeding to establish 
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_independent test facilities capable of keeping current with state-of- 
the-art in this field. Although this effort will probably extend well 
into FY-74, the accomplishment is evident and could well result in 
the development and utilization of entirely new locking concepts. 


25X1 
In FY-72 the Division was given full responsibility for the 
installation and maintenance of all intrusion alarm systems in the 
Headquarters area. This was the first time that these systems had 
been maintained and installed by other than commercial contractors. 
Evidence to date has indicated that this has been an effective move. 55x 


The almost universal emphasis on pollution-free environ- 
ment, has presented new problems in classified material destruction. 
As a result, an entirely new program has been undertaken to obtain 
devices suitable for emergency classified waste destruction which 
are sufficiently flexible to meet both pollution and operational re- 
quirements. A number of devices have been evaluated and put into 
use that tend to meet these needs. 


Safety Staff 


The Safety Staff conducted a Vulnerability Survey of all 
Agency Headquarters Computer Facilities at the request of the 
Information Processing Board. This survey provided a compre- 
hensive analysis of the damage potential from water, fire and 
electricity. 
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As a result of the Occupational Safety and Health Act, re- 
porting forms were revised and distributed. Briefings describing 
their duties and responsibilities under the Act were given to 46 
component Safety Officers. Approximately 100 copies of the 
Presidential Order, Occupational Safety and Health Act, and the 
Labor Department Safety Standards were distributed throughout 
the Agency to concerned offices. 


Preparation of special quarterly and annual reports to the 
Secretary of Labor regarding: (1) implementation of safety standards 
required by the Occupational Safety and Health Act, (2) record 
keeping and reporting as required by the Occupational Safety and 
Health Act, and (3) annual safety and health report for calendar 
year 1971. 


- II. MAJOR ACCOMPLISHMENTS AND FAILINGS (for increased 
effort) 


[oY 


Improved Communications - During the reporting period the 
utilized its expanded resources to 

develop effective communication channels with the operating com- 
puter components. The addition to this Branch of personnel possessing 
genuine computer expertise and practical experience was a signifi- 
cant factor in this improved exchange of information. Consequently, 
the [has been able to exert an in- 
formal] influence over computer security policy decisions made 
within the four principal operating components within the Agency. 
This influence has been extended beyond that which is reflected in 
the formal flow of interoffice communication. 


Improved Comprehension of Computer Security Problems - 
Another of the beneficial effects which resulted from the application 
of additional human resources to computer security problems is a 
better awareness of the nature and scope of the whole computer 
security problems which exists within CIA. This educational pro- 
cess has permitted the development of improved computer security 
guidelines, based upon greater knowledge of the general problem 
as well as an awareness of the unique problems in each computer 
center. 
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Participation in Hardware -Software Security Tests - Another 


important accomplishment in the past year was the participation of 
members of the[_________}in testing of the 25X1 
hardware-software security features of two different computer sys- 
tems. Information derived from these tests has been of assistance 
in the analysis of CIA computer security problems, as well as 
demonstrating the potential for positive collection techniques which 
may be of interest to the Clandestine Service. A member of the 
was selected to serve on the Software 

valuation Panel of the Intelligence Community Test Team that was 
assembled to conduct the multi-level security test of the DIA Time- 
Sharing System. The second significant test of a computer software 
system was the intra-agency test of the IBM developed Resources 
Security System software package. This was held between September 
1971 and February 1972. 


Office of Security Approval of the CAPER-OS and CENBAD 
Systems -The[_ acting a8 the inter- 


face between the Office of Security and the Support Information 
Processing Staff (SIPS), supervised the internal Office of Security 
staffing and coordination which culminated in the acceptance by the 
Director of Security of the SIPS proposals for the Case Processing 
(CAPER-OS) and Central Badging (CENBAD) Systems. These sub- 
projects of the comprehensive DD/S Manpower Control System have 
the potential for making a significant change in the operations of 
several Office of Security components. 


Resource Limitations - A weakness which became increas- 
ingly evident during the year.was the fact that the human resources 
available to the ee not permit 
equal coverage of the Agency's four computer centers. Branch 
personnel, by necessity, have concentrated the majority of their 
efforts on the OCS System, while other systems and offices having 
real or potential computer security problems have not received the 
attention these problems warrant. Another consequence of this 


limitation on resources is the in- 
ability of Branch personnel to undertake follow-up inspections of 


previous actions. The beginning of a series of accreditation tests 
limit its ability to effectively monitor all individual computer se- 


curity problems. 
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SIPS Security Problems - The 
Branch has not undertaken a detailed analysis of the security and 
privacy concerns inherent in the adoption of the DD/S SIPS Man- 
power Control System. The use of an on-line, real-time data base, 
which will contain current medical, personal, financial, and 
security records about each staff employee, will require careful 
analysis to insure that the twin concerns of security and privacy 
are adequately controlled. 
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Several major modifications to the Headquarters closed 
circuit television system have been developed in-house that have 
improved the overall reliability. Additionally, the closed circuit 


television system ee ee 25X1 
utilizing motion detecting circuits has been under actual in-use 


test. Modifications to this system have been developed in-house 
and have resulted in bringing the false alarm rate of this type 
system to a tolerable level. 
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A new security container approved for Federal Supply Schedule 
has been tested and evaluated by members of this Branch and our 
counterparts in the Department of State. In the course of the evalua- 
tion, numerous weaknesses were found that made the container sub- 
standard. Efforts have been completed with the manufacturer of the 
container to incorporate in his basic design features that make the 
container more secure and suitable for overseas use. 


During the year a number of commercial locking devices have 
been evaluated for residential installation. The information gained 
from this evaluation has been included in briefings and training pro- 
grams conducted by the Branch for personnel going abroad confronted 
with securing their premises against vandalism and burglarious 
attack. Training aids and displays of these residential locking 
devices have also been made and installed in the Branch training 
facility. 


Due to the emphasis in ecology, a program has been under- 
taken through Technical Services Division to develop al | 25X1 
collector that would be lightweight and inexpensive and that can be 
used with existing installations Mt et tee 25X14 
A prototype collector has been completed and its value proven in 
FY-72. Further test and evaluation will continue into FY-73 and 


hopefully field testing of two of these devices will be accomplished 
within the next six months. 


In a continuing effort to remain current with the increasing 
number of different units of security equipment, the Branch has 
called upon its liaison contacts in industry to furnish detailed sche- 
matics, brochures, blueprints, etc., concerning each unit of equip- 
ment. These drawings and information pamphlets have been taken 
and reproduced into effective training aids and have been distributed 
not only to Agency trainees, but to other agencies having similar 
training programs. For the first time the Branch is in possession 
of exploded view drawings and detailed parts literature on every 
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model safe and vault door developed and in government use since 

1955. Also a considerable number of drawings and training aids 

concerning the latest locksf Cave 25X1 
also been developed. 


Safety Staff 


One hundred and fifty-four safety meetings and conferences 
were attended by the Safety Staff to advise various components 
throughout the Agency of the most practical and economical means 
of providing a safe work environment for personnel within the limit 
described by the Occupational Safety and Health Act. 


' The Safety Staff conducted comprehensive fire and safety 
surveys a IT Headquarters faci- 
lities. The reports o ese surveys are forwarded to the Directorates 
involved who reply with a status report. 


Eighty-five special inspections were completed to determine: 
(1) the adequacy of emergency lighting for exit purposes; (2) fire 
protection for computer and essential electronic areas; (3) special 
purpose vaults; (4) traffic safety; (5) electrical and mechanical 
equipment, etc. 


25X1 


The Safety Staff is also responsible for coordination of 
local explosive ordnance disposal units in the Washington area to 
insure proper response in times of emergency. The staff, on its 
own on occasion, had to remove from buildings and destroy such 
material as nitrate film, ethylene oxide, potassium nitrate, mag- 
nesium plates, etc. Approximately ten operations of this nature 
were conducted by the Safety Staff. 


Twelve special tests were conducted to insure the safety of 
Agency personnel. Such tests included noise levels, electrical 
ground and atmospheric for such toxic elements as CO ~ CO, and 
ozone. 
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In the furtherance of the Fire Protection Program, 24 
operations were conducted to test members of the Security Duty 
Office and Federal Protective Service in their reaction to simu- 
lated emergency conditions. Included also were actual test of 
fire protection and detection systems and fire drills evacuating 
ten buildings in the Washington area. 


Twenty-six selected personnel from various Directorates 
were given special training in fire fighting, resuscitation, use of 
gas masks, extinguishment of Molotov cocktails. and pyrotechnic 
items, and use of tear gas material. 


The Safety Staff reviewed approximately 501 reports of 
personal injuries, 80 reports of motor vehicle accidents, and 11 
reports of fires. Detailed information of each accident was re- 
corded in the Safety Staff files for the annual analyses. 


Completed annual analyses of all occupational injuries 
incurred by CIA employees, accidents, and fires involving CIA 
motor vehicles and property. A comprehensive report of these 
analyses was prepared and distributed to the Deputy Director for 
Support for briefing the Director of Central Intelligence and also 
to members of the CIA Safety Committee in accordance with the 
Annual Report to the Secretary of Labor. 


Prepared four quarterly reports to the Federal Safety 
Council, Department of Labor, advising of the disabling injury 
frequency rate for injuries incurred by CIA employees as required 
by the Secretary of Labor. 


In order to comply with the Presidential Directive to co- 
operate and assist the Secretary of Labor in providing a good 
safety program for the Federal Government, the members of the 
Safety Staff have attended and participated in approximately 20 
Headquarters regional, and special interest group safety meetings. 


Thirty-five personnel from various Directorates were 
briefed regarding fire alarm systems in the Headquarters and 
Printing Services Buildings. 
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tThe[ has identified two sig- 


nificant trends which it believes will have a potentially important 
impact upon the computer security environment within CIA. 


The first of these is the eventual grouping of 
the now separate CIA computer centers into one inter- 
connected network. Thus a computer job submitted 
for processing to ISD computer center could have the 
potential of being accomplished by a CRS or OCS com- 
puter. The full security ramifications of this inter- 
connection have yet to be fully understood and studied. 


The requirement of DCID 1/16 for the accredi- 
tation of computer systems used to process multi-level 
sensitive compartmented information will result in 
additional analysis, test and evaluation projects being 
conducted. Each of these tests will contribute to the 
body of knowledge available about the computer se- 
curity environment found in CIA. 

It is envisioned that the Division will be placing increased 


emphasis on R&D and D&E through the designated components, 
TSD and DD/S&T. 


Safety Staff 


The Safety Staff will conduct approximately 19 comprehensive 
fire and safety surveys of[_—————sd| Headquarters facilities. 25X1 


Approximately 35 Safety Officers representing various com- 
ponents within the Agency will be briefed regarding their, as well 
as the Agency's, responsibilities under the Occupational Safety and 
Health Act and Executive Order 11612. Copies of the Act, Executive 
Order, and Safety Standards will be distributed to these Safety 
Officers. 
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Fifty-two unannounced simulated after-hours fire drills 
will be conducted in the Headquarters Building to evaluate the 
effectiveness of existing emergency response procedures. 


It is anticipated that approximately 200 personnel from 
various Directorates will be given special training in fire fighting, 
resuscitation, use of gas masks, extinguishment of Molotov cock- 
tails, pyrotechnic items, and use of tear gas material. 


Approximately 150 personnel from various Directorates 
will be briefed regarding the operation of fire alarm systems in 
the Headquarters and Printing Services Division Buildings. 


Approximately 30 fire alarm tests by the Safety Staff are 
scheduled for the next fiscal year. These tests will be of sprinkler 
systems, rate-of-rise set temperature systems, smoke detection 
systems, and manual alarm systems. 


Reports of personal injuries, accidents, and fires will 
continue to be analyzed as received, with the more serious indi- 
dents in the Headquarters area being investigated by Safety Staff 
personnel. Appropriate quarterly and annual reports will be sub- 
mitted to the Secretary of Labor as required by the Occupational 
Safety and Health Act. 
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DC/PhySD 17 July 1972 
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building) OFFICER'S COMMENTS (Number each comment to show from whom 
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